coiinbase-logiin[.]blogspot[.]mx

This domain is classified as high-risk due to targeted brand impersonation, specifically mimicking Coinbase to facilitate credential theft or unauthorized cryptocurrency transactions. Analysis indicates the domain coiinbase-logiin.blogspot.mx was designed to deceive users into disclosing sensitive login credentials or executing fraudulent transactions under the guise of legitimate Coinbase operations. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 142.250.195.161, hosted under AS15169 (Google LLC) in the US. It was originally registered on May 31, 2009, through MarkMonitor, Inc., though the current malicious activity suggests compromise or repurposing. Security vendors on VirusTotal flagged the domain with 12/95 detections, while Google Safe Browsing explicitly labels it as phishing. The domain appears on three security blocklists and uses an SSL certificate issued by Google Trust Services (WE2). The page title, 'How do I buy Bitcoin on Coinbase?', further confirms its intent to impersonate Coinbase support content. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into endpoint detection and response (EDR) systems. User awareness training should emphasize verifying domain authenticity, particularly for subdomains or misspelled variations of legitimate brands. Multi-factor authentication (MFA) should be enforced for all cryptocurrency-related accounts to mitigate the impact of credential theft. Monitoring for similar impersonation patterns, such as typosquatting or subdomain abuse, is recommended to preempt further incidents.